As seen, these are a comprehensive collection of controls. Version 8.1 maintains the streamlined 18-control structure established in Version 8.
Version 8.1 continues with the practice of identifying Implementation Groups (IG) 1, 2, and 3. These are intended to be approached in sequence, achieving compliance with IG 1 before moving to IG 2. Crucially, CIS Controls v8.1 does not change the mapping of these IGs—helping ensure that organizations already on the path to IG1 compliance do not have to restart their efforts. Each Implementation Group contains safeguards across the various control areas.
As in all cybersecurity standards, developing a robust asset and network inventory is the base element that enables the rest of security to be effective. This is clear in CIS Controls Top 18 just as it is with NIST CSF.
Controls 1 and 2 require hardware inventory or OS inventory as well as comprehensive software inventory on all assets. As one learns about the safeguards of these controls, the power of a deep asset inventory that extends beyond seeing if a hardware device is on the network becomes obvious.
To summarize IG 1 vs. IG 2 and 3, IG 1 focuses on those elements that can be the initial set of safeguards applied. In v8.1, these are now mapped more precisely to modernized asset classes, which allows software to be tracked as a distinct asset type from the physical devices that host them.
Many of the IG 1 tasks are focused on what we’d call asset management—accurate inventory, accurate vulnerability picture, basic networking protections, knowledge of privileged access, timely backups, and so on. These core elements reflect the importance of visibility deep into the environment and the ability to control access, software, and recovery.
How are CIS Controls Implemented?
To achieve maturity for CIS, it requires more than a passive review of assets. This is particularly challenging in OT and creates challenges that we have addressed within SecureOT Platform.
Rockwell Automation works with clients to adapt the standard and enable a single standard across IT and OT. Because CIS Controls v8.1 now directly aligns with the NIST CSF 2.0 Govern function, using SecureOT Platform allows organizations to satisfy both frameworks simultaneously. We work closely with industrial organizations to establish CIS Controls Top 18 programs and build dynamic compliance and security management processes. It’s important to note that the transition to CIS Controls v8.1 provides stability for these programs. Because the IGs remain unchanged, organizations starting at IG1 can continue their progress without disruption.
To bridge these controls from IT into OT, you need to make several adjustments.
Feasibility of Controls
Many controls are not feasible on embedded industrial devices such as PLCs, controllers, and drives. These include items like anti-virus or application whitelisting. In these cases, CIS Controls v8.1’s focus on “Compensating Controls” and the new Govern function allows managers to document exactly why a control isn’t feasible and what alternative protections are in place to navigate the risk.
Some controls are feasible, but the level of reasonable maturity may differ. These include items such as patching on a bi-weekly or monthly basis which is often not appropriate in operational facilities that cannot be regularly rebooted.
OT Customization
Procedural requirements may need “OT customization,” such as items like incident response or red teaming, which require different procedures due to the sensitivity of OT processes. The introduction of “Documentation” as a formal asset class in v8.1 validates this work. For an OT manager, documenting these customized procedures is now recognized as a core security achievement.
Specific Secure Standards
Specific secure standards often need adjusting. For instance, CIS calls for standard secure configurations for different device types. Those configurations will likely be different for OT devices.
Even though there are several adjustments required, there are significant benefits to using this common standard across OT and IT. This includes:
- Common reporting and measurement across the organization.
- Shared understanding and vocabulary on security simplifies training and communication.
- The “prescriptive” nature can accelerate time to security.
- Editing a standard has proven much easier than creating from scratch.
The CIS Controls Top 18 really requires what we have come to call OT Systems Management. This practice is similar to IT Security Management, which has been practiced for many years. But in OT, assets are not actively managed for many of the reasons above. Implementing CIS Controls as a standard drives greater security and more robust and reliable operations because systems are managed, updated, and controlled on a regular basis.
Over the past decade, we’ve worked with clients implementing different security standards including NIST CSF, 800-53, NERC CIP, and ISA99. While each has its merits, we have found that CIS Controls v8.1 has emerged as the gold standard for large organizations that seek consistency between IT and OT.
With the release of version 8.1, CIS Controls moved beyond a checklist to become a true management framework that brings IT and OT under one umbrella of governance. This shift is critical for security managers since it provides a roadmap that’s prescriptive for the plant floor and strategically aligned for the boardroom.
By adopting CIS Controls v8.1, organizations no longer have to manage two separate security programs. Instead, they can use a single, unified framework that respects the unique constraints of operational technology while providing the rigorous oversight required by corporate IT. Whether you are starting from scratch at IG1 or scaling toward IG3, the path to a resilient and compliant industrial environment has never been clearer.
Bridge the Gap Between IT and OT
CIS Controls v8.1 provides the roadmap, but knowing your starting point is critical. Take our Cybersecurity Preparedness Assessment to evaluate your current maturity level and identify the specific safeguards needed to secure your industrial environment.
